articles:proxmox_span
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
articles:proxmox_span [2018/04/27 17:27] – veera | articles:proxmox_span [2018/04/27 17:52] (current) – [Add a new interface to a VM using this bridge vmbr7] veera | ||
---|---|---|---|
Line 2: | Line 2: | ||
- | Proxmox VE is a leading enterprise virtualization platform that uses a KVM based hypervisor | + | Proxmox VE is a leading enterprise virtualization platform that uses a KVM based hypervisor |
+ | |||
+ | In this article we talk about how you can create a Proxmox Virtual Machine running TrisulNSM and how you can connect a port span cable and bring the traffic into the virtual machine. | ||
===== The setup ===== | ===== The setup ===== | ||
+ | |||
+ | The challenge is to map a single physical port on the server running Proxmox to an interval VM which will be running Trisul Network Analytics. | ||
{{: | {{: | ||
+ | |||
+ | |||
+ | ==== Create a new bridge ==== | ||
+ | |||
+ | |||
+ | The good news is Proxmox is based on Debian9 and you can login directly to the system and make configuration changes. | ||
+ | |||
+ | Edit ''/ | ||
+ | |||
+ | <code bash> | ||
+ | |||
+ | auto vmbr7 | ||
+ | iface vmbr7 inet manual | ||
+ | bridge_ports enp2s0f1 | ||
+ | bridge_stp off | ||
+ | bridge_fd 0 | ||
+ | bridge_ageing 0 | ||
+ | |||
+ | </ | ||
+ | |||
+ | Then | ||
+ | |||
+ | < | ||
+ | systemctl restart network | ||
+ | </ | ||
+ | |||
+ | |||
+ | Basically, this creates a dumb bridge with zero bridge_ageing, | ||
+ | |||
+ | Now '' | ||
+ | |||
+ | |||
+ | ==== Add a new interface to a VM using this bridge vmbr7 ==== | ||
+ | |||
+ | Next logon to Proxmox VE and add a new sniffing interface using //Hardware -> Add -> Network Device// | ||
+ | |||
+ | Then select the new bridge for this interface as shown below | ||
+ | |||
+ | {{: | ||
+ | |||
+ | Then go back and review the VM, there should be TWO intefaces, one for management and the other for the sniffing. | ||
+ | |||
+ | {{: | ||
+ | |||
+ | |||
+ | |||
+ | ===== Configure the capture interface within the VM ===== | ||
+ | |||
+ | Now boot up the VM and you will find two adapters. | ||
+ | |||
+ | Typing '' | ||
+ | |||
+ | {{: | ||
+ | |||
+ | |||
+ | <note important> | ||
+ | |||
+ | |||
+ | We're done. Now, all you need to do is capture from '' | ||
+ | |||
+ | |||
+ | Hope this helps. Trisul is designed to be frugal in resource usage , we can install several such Trisul on a single Proxmox platform using this technique. | ||
+ | |||
+ | |||
+ | -end- | ||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
articles/proxmox_span.1524830273.txt.gz · Last modified: 2018/04/27 17:27 by veera